PT-2024-31834

Name of the Vulnerable Software and Affected Versions DrayTek Vigor3900 version 1.5.1.3 Description The issue is a command injection problem that occurs when the action parameter in the "cgi-bin/mainfunction.cgi" endpoint is set to delete map profile. This allows for potential exploitation...

CVE-2024-45893

DrayTek Vigor3900 version 1.5.1.3 is susceptible to a post-authentication command injection vulnerability. The flaw exists when the action parameter in the cgi-bin/mainfunction.cgi endpoint is set to setSWMOption, allowing an attacker to execute arbitrary commands. As a temporary workaround, it i...

CVE-2024-45888: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to setapmapconfig.'...

PT-2024-31836

Name of the Vulnerable Software and Affected Versions DrayTek Vigor3900 version 1.5.1.3 Description The issue is a post-authentication command injection vulnerability. It occurs when the action parameter in the "cgi-bin/mainfunction.cgi" endpoint is set to autodiscovery clear. This vulnerability...

CVE-2024-45882: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to deletemapprofile...

CVE-2024-45890: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to downloadovpn...

CVE-2024-45891

The DrayTek Vigor3900 router, specifically version 1.5.1.3 , is susceptible to a post-authentication command injection vulnerability. The flaw exists in the cgi-bin/mainfunction.cgi endpoint when the action parameter is set to delete_wlan_profile. This vulnerability allows an attacker to execute ...

CVE-2024-45890

The DrayTek Vigor3900 (v1.5.1.3) , Vigor 2960 , and Vigor 300B routers are susceptible to a post-authentication command injection vulnerability. The flaw exists within the set_ap_map_config() function of the cgi-bin/mainfunction.cgi script. It is caused by a failure to neutralize

CVE-2024-45885: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to autodiscoveryclear...

CVE-2024-45888

DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to setapmapconfig.'...

CVE-2024-45889: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to commandTable...

CVE-2024-45887: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to doOpenVPN...

CVE-2024-45893: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to setSWMOption...

CVE-2024-48074

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...

CVE-2024-48074: Improper Neutralization of Special Elements used in an OS Command

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...

CVE-2024-48074

An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function...

CVE-2024-46316: Improper Neutralization of Special Elements used in an OS Command

DrayTek Vigor3900 v1.5.1.6 was discovered to contain a command injection vulnerability via the sub2C920 function at /cgi-bin/mainfunction.cgi. This vulnerability allows attackers to execute arbitrary commands via supplying a crafted HTTP message...

CVE-2024-43027

DrayTek Vigor 3900 before v1.5.1.5Beta, DrayTek Vigor 2960 before v1.5.1.5Beta and DrayTek Vigor 300B before v1.5.1.5Beta were discovered to contain a command injection vulnerability via the action parameter at cgi-bin/mainfunction.cgi...

CVE-2024-43027: Improper Neutralization of Special Elements used in a Command

DrayTek Vigor 3900 before v1.5.1.5Beta, DrayTek Vigor 2960 before v1.5.1.5Beta and DrayTek Vigor 300B before v1.5.1.5Beta were discovered to contain a command injection vulnerability via the action parameter at cgi-bin/mainfunction.cgi...

CVE-2020-15415: Improper Neutralization of Special Elements used in an OS Command

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472...